If clients tell the server "I am here" and "I hit him", a cheater can simply send "I teleported" or "I hit everyone". With an authoritative server, clients send only inputs, the server simulates the game and validates everything, and the result it broadcasts is the truth.
A authority: client / serverC send a cheatUse the buttons● keys go to this demo
Try this: With client authority, press Cheat: the teleport and the 999 damage go through. Switch to server authority (A) and cheat again.
Press Cheat.
Prompt bit
Works for 2D or 3D in any engine (Unity, Unreal, Godot, web). Paste the short one for a quick fix, or the detailed one when you want it done properly.
Make the server authoritative: clients send only inputs, the server simulates movement, combat and pickups and rejects impossible actions (moves faster than max speed, fire rates under 0.1 s), and clients only display server results, even for the host player.
40 words · one sentence to paste as is
Structure multiplayer with an authoritative server (dedicated or host; works with Netcode for GameObjects, Mirror, Fish-Net, Godot high-level multiplayer, Colyseus, Nakama). Clients send input commands (move vector, jump, fire with aim direction and a timestamp), never positions, health or hit results. The server runs the simulation at a fixed tick, validates every command (rate limits, cooldowns, max speed, line of sight, ammo), resolves hits with lag compensation if needed, and broadcasts state snapshots. Clients predict their own movement and interpolate others, but always accept the server state. Keep secret state (other players' positions behind walls, loot rolls) on the server. Log and kick clients that send impossible input. Treat the listen-server host the same as other clients in code paths.
120 words · includes defaults, tunables and edge cases
Where it's used
Competitive shooters: anti-cheat by design
MMOs: economy and loot on the server
Battle royales: hit validation and zone logic
Mobile PvP: clients are easy to modify
Co-op: one consistent world for everyone
Common mistakes
Trusting client positions or damage values, validating nothing, letting the host skip the rules, sending hidden information to clients, and doing gameplay logic in client-only code that never runs on the server.
